docs: add AgentSystems Notary integration

[brandon-agsys]

Describe your changes

Adds an Integrations page for AgentSystems Notary — a tamper-evident audit sink for Agent Control events.

Uses the public register_control_event_sink() API with a BaseControlEventSink subclass shipped in agentsystems-notary[agent-control].

Shortcut ticket

For Galileo internally raised PRs only, please update this with your shortcut ticket.

SC-number

Keep the formatting, replacing SC-number with the shortcut ticket, e.g. [SC-12345], and adding the link to the ticket correctly in the brackets. This format is important as it allows Shortcut to track the ticket, moving the status to in review, then merged once the ticket is merged.

For external PRs, please add the issue (just put the number after the # below, and GitHub will automatically create a link):

Issue: #37

Checklist before requesting a review

• - Is this ready for review? If not, raise as a draft PR
• - This deployed to a staging environment correctly
• - I have reviewed my changes
• - I have reviewed the deployed version of my changes
• - I have tested any code that is added or updated
• - I have verified all images and videos are clear, with appropriate zoom
• - I have verified all images and videos match production (or dev for unreleased features)
• - I have tested that the content matches the functionality in production (or dev for unreleased features)
• - All checks have passed
• - This references a feature that is public. If not, add a note and we can schedule the merge for after the feature release

[namrataghadi-galileo]

This appears to change the hashing source from raw payload bytes to canonical JSON. Please clarify which bytes are actually hashed so the verification instructions stay accurate.

[brandon-agsys]

Good catch, @namrataghadi-galileo - the doc was conflating "Agent Control event" with "Notary record."

To clarify: Agent Control events are consumed as a Python dict via event.model_dump() and embedded as the pre_execution_record field of a Notary record (alongside metadata, input, output). The Notary record is what gets JCS-canonicalized (RFC 8785) and SHA-256 hashed - so however you evolve ControlExecutionEvent, Notary's hashing handles it deterministically and past hashes remain verifiable. Verification is sha256(stored_bytes) against the stored hash.

Updated the relevant sections in the latest commit. Thanks!